JPWO2020039527A1 - Signature processing device, signature processing method, signature processing system, and program - Google Patents

Abstract

The private key information generation unit 2 that generates the private key information corresponding to the application identification information based on the master private key information set in advance and the application identification information that identifies the application, and the private key information and the signature target. In the process of generating the secret key information or the signature information with the signature information generation unit 3 that generates the signature information corresponding to the message information based on the message information, the master secret key information, the private key information, or It is a signature processing device 1 having a concealment unit 4 having a concealment area for temporarily storing both of them.

Description

The present invention relates to a signature processing apparatus for performing signature processing, a signature processing method, and a signature processing system, and further relates to a computer-readable recording medium on which a program for realizing these is recorded.

In digital signature technology, a white box mounting method has been proposed. The white box implementation method is a method of dealing with an attack from an attacker on the assumption that the attacker has full access to the entire signature processing system. For example, the white box mounting method is a mounting method that protects the private key mounted on the device even when the endpoint (execution environment, etc.) is placed in a hostile environment.

Further, in the digital signature technology, when a service is used, there is a method of dynamically generating a private key for each service by using an application corresponding to the service. In that method, the generated private key is used for signing.

As related techniques, Patent Document 1 and Patent Document 2 disclose a device for generating a private key by an ID-based signature method.

Japanese Unexamined Patent Publication No. 2006-163164 International Publication No. 2010/067812

By the way, in the white box mounting method, an application having a digital signature function is created with a private key before being mounted on the device, and the created private key is set (stored) in the device. For example, the manufacturer that manufactures the device creates a private key and sets the created private key in the manufactured device.

However, when the private key is dynamically generated, that is, when the device generates the private key during the execution of the application, it is difficult to protect the private key as in the white box implementation method. Therefore, even when the private key is dynamically generated, there is a desire to protect the private key as in the white box implementation method.

It is difficult to dynamically generate a private key in the devices disclosed in Patent Documents 1 and 2. Therefore, even if the devices disclosed in Patent Documents 1 and 2 are used, it is not possible to protect the dynamically generated private key as in the white box mounting method.

An example of an object of the present invention is to provide a signature processing device, a signature processing method, a signature processing system, and a computer-readable recording medium capable of protecting a private key even when dynamically generating private key information. ..

In order to achieve the above object, the signature processing device in one aspect of the present invention is
A private key information generation unit that generates private key information corresponding to the application identification information based on preset master private key information and application identification information that identifies an application.
A signature information generation unit that generates signature information corresponding to the message information based on the private key information and the message information to be signed.
In the process of generating the secret key information or the signature information, a secret unit having a secret area for temporarily storing the master secret key information, the secret key information, or both of them.
It is characterized by having.

Further, in order to achieve the above object, the signature processing method in one aspect of the present invention is:
(A) A step of generating the private key information corresponding to the application identification information based on the preset master private key information and the application identification information for identifying the application.
(B) A step of generating signature information corresponding to the message information based on the private key information and the message information to be signed.
(C) In the process of generating the secret key information or the signature information, a step of temporarily storing the master secret key information, the secret key information, or both in a secret area, and
It is characterized by having.

Further, in order to achieve the above object, the signature processing system in one aspect of the present invention may be used.
A setting device that sets the master private key information generated based on security information in the signature processing device in a secret state, and
Based on the preset master private key information and the application identification information that identifies the application, the private key information corresponding to the application identification information is generated, and based on the private key information and the message information to be signed. , The master secret key information, the secret key information, or both are temporarily stored in the secret area in the process of generating the signature information corresponding to the message information and generating the secret key information or the signature information. With the terminal device
It is characterized by having a verification device that verifies the signature information based on the message information.

Further, in order to achieve the above object, a computer-readable recording medium on which a program according to one aspect of the present invention is recorded may be used.
On the computer
(A) A step of generating the private key information corresponding to the application identification information based on the preset master private key information and the application identification information for identifying the application.
(B) A step of generating signature information corresponding to the message information based on the private key information and the message information to be signed.
(C) In the process of generating the secret key information or the signature information, a step of temporarily storing the master secret key information, the secret key information, or both in a secret area, and
Is characterized by executing.

As described above, according to the present invention, the private key can be protected even when the private key is dynamically generated.

FIG. 1 is a diagram showing an example of a signature processing device. FIG. 2 is a diagram showing an example of a signature processing system (registration). FIG. 3 is a diagram showing an example of a signature processing system (authentication). FIG. 4 is a diagram showing an example of a signature processing system (modification example 1). FIG. 5 is a diagram showing an example of a signature processing system (modification example 2). FIG. 6 is a diagram showing an example of the operation of the signature processing system (registration). FIG. 7 is a diagram showing an example of the operation of the signature processing system (authentication). FIG. 8 is a diagram showing an example of a computer that realizes a signature processing device.

(Embodiment)
Hereinafter, embodiments of the present invention will be described with reference to FIGS. 1 to 8.

[Device configuration]
First, the configuration of the signature processing device 1 according to the present embodiment will be described with reference to FIG. FIG. 1 is a diagram showing an example of a signature processing device.

The signature processing device 1 in the present embodiment shown in FIG. 1 is a device capable of protecting the private key even when the private key is dynamically generated. Further, as shown in FIG. 1, the signature processing device 1 has a private key information generation unit 2, a signature information generation unit 3, and a secret unit 4.

Of these, the private key information generation unit 2 has the private key information corresponding to the application ID based on the preset master private key information (master private key msk) and the application identification information (application ID) that identifies the application. Generate (private key sk). _{The signature information generation unit 3 generates signature information (δ ID} , M) corresponding to the message M based on the private key sk and the message information (message M) to be signed. The secret unit 4 has a secret area for temporarily storing the master secret key msk, the secret key sk, or both in the process of generating the secret key sk or the signature information (δ _{ID, M).}

The secret area of the secret unit 4 is a secure memory area that is difficult to access from the outside. For example, when the hardware of the signature processing device 1 is a circuit configured by using a CPU (Central Processing Unit), it is conceivable to use a cache memory of the CPU or the like. Further, for example, it is conceivable that the signature processing device 1 is realized in a state where data cannot be accessed from the outside, such as dedicated hardware and TEE (Trusted Execution Environment). Further, the application ID is information that identifies an application corresponding to the service provided by the service provider. The message M is information such as plain text and image data transmitted from the service provider.

As described above, in the present embodiment, even when the private key sk is generated during the execution of the application, the private key sk can be protected as in the white box implementation method. That is, even when the secret key sk is dynamically generated based on the master secret key msk stored in advance in the signature processing device 1 and the application ID that identifies the application, the secret key sk is generated by using the secret unit 4. Since it is generated, it is possible to prevent the private key sk from being leaked to the outside. Further, in the present embodiment, based on the message M is signed with a private key sk, signature information ([delta] _ID, M) even when generating the signature information ([delta] _ID uses the encryption unit 4, Since M) is generated, it is possible to prevent the private key sk from being leaked to the outside.

Further, as a white box mounting method, it is conceivable that a plurality of private key sks for an assumed application are stored in advance in the signature processing device 1. In that case, the manufacturer grasps the private key sks. Therefore, it cannot be said that the private key sk is completely protected. Further, as a white box mounting method, since a plurality of private keys sk are stored in the signature processing device 1, the storage capacity of the signature processing device 1 is increased.

However, in the present embodiment, since the signature processing device 1 dynamically generates the secret key sk while concealing it for each application, it is possible to prevent the manufacturer from grasping the secret key sk. Further, since a plurality of private keys sk are not stored in the signature processing device 1 in advance, the storage capacity of the signature processing device 1 can be reduced.

Further, when changing the private key sk stored in advance in the signature processing device 1, for example, when it is required to update the private key sk to ensure security, the private key is used as in the white box mounting method. It is difficult to protect the sk. However, in the present embodiment, since the signature processing device 1 can dynamically generate the private key sk while concealing it, even if the private key sk is changed, the private key sk is protected so as not to be leaked to the outside. Can be done.

[System configuration]
Subsequently, with reference to FIGS. 2 and 3, the signature processing system 20 according to the present embodiment will be described with reference to an example when applied to authentication. FIG. 2 is a diagram showing an example of a signature processing system (registration). FIG. 3 is a diagram showing an example of a signature processing system (authentication).

As shown in FIGS. 2 and 3, the signature processing system 20 in the present embodiment includes a setting device 21, a terminal device 22, and a verification device 23. Further, the terminal device 22 has a signature processing device 1. Further, the signature processing device 1 of FIG. 2 has a public key information generation unit 24 in addition to the private key information generation unit 2, the signature information generation unit 3, and the secret unit 4.

The setting device 21 sets the master private key information generated based on the security information (security parameter k) in the signature processing device 1 of the terminal device 22 in a secret state. The setting device 21 is provided at the manufacturer that manufactures the terminal device 22.

Specifically, the setting device 21 first acquires the security parameter k prepared by the manufacturer, and based on the security parameter k, the master public key information (master public key mpk) and the master private key corresponding to the security parameter k. Generate msk and. The security parameter k is a parameter that determines the strength of security required by the user, and is, for example, the number of bits of the private key sk or the length of the message M.

Subsequently, the setting device 21 stores the generated master public key mpk and master private key msk in the signature processing device 1 of the terminal device 22. The setting device 21 generates, for example, a public key generation program and a private key generation program in which the master private key msk is embedded, installs the public key generation program in the public key information generation unit 24, and installs the private key generation program in the private key. Install in the information generation unit 2.

The master secret key msk is stored in the white box mounting method. Further, since the master private key msk is embedded in the public key generation program and the private key generation program, respectively, the master private key msk can be further protected.

The terminal device 22 is a device that executes registration for using the service and authentication performed when the service is used. The terminal device 22 is, for example, a personal computer, a notebook computer, a smart phone, a tablet, or the like.

Registration for using the service will be described with reference to FIG.
The public key information generation unit 24 of the signature processing device 1 provided in the terminal device 22 uses the preset master private key msk, the application ID corresponding to the service, and the master public key mpk as the application ID. Generate the corresponding public key pk.

Further, the secret unit 4 of the signature processing device 1 provided in the terminal device 22 stores the master private key msk, the public key pk, or both of them, which are generated in the process of generating the public key pk, in a secret area. Temporarily memorize in. Further, the secret unit 4 may temporarily store the calculation result related to the master secret key msk, which is generated in the process of generating the public key pk, in the secret area.

Subsequently, the terminal device 22 transmits the public key pk to the verification device 23 provided in the service provider server or the like. When the verification device 23 receives the public key pk, the verification device 23 stores the public key pk.

The authentication performed when using the service will be described with reference to FIG.
The secret key information generation unit 2 of the signature processing device 1 provided in the terminal device 22 first generates a secret key sk corresponding to the application ID based on the master secret key msk and the application ID. Subsequently, the signature information generation unit 3 of the signature processing device 1 provided in the terminal device 22 bases the signature information (δ _{ID) corresponding to the message M based on the private key sk and the message M to be signed to be used for authentication.} , M) is generated. Subsequently, the terminal device 22 transmits the generated public key pk and signature information (δ _ID , M) to the verification device 23.

Here, the secret key information generation unit 2 and the signature information generation unit 3 have a master secret key msk or a master secret key msk in the secret area of the secret unit 4 in the process of generating the _{secret key sk or signature information (δ ID, M).} Temporarily store the private key sk or both.

Further, the secret unit 4 is generated in the process of generating the secret key sk or signature information (δ _ID , M), the calculation result related to the master secret key msk, the calculation result related to the secret key sk, or the calculation result. , The calculation results related to both of them are temporarily stored in the generation process.

In the process of generating the secret key sk or the signature information (δ _ID , M), the secret unit 4 determines that the master secret key msk, the secret key sk, and the calculation result will not be used for the subsequent generation. The master secret key msk, secret key sk, and calculation result temporarily stored within a predetermined time are deleted from the secret area.

The verification device 23 verifies the signature information (δ _ID , M) based on the message M. _{Specifically, the verification device 23 verifies the signature information (δ ID} , M) generated based on the message M by using the public key pk registered when using the service. Further, when the verification device 23 receives the signature information (δ _ID , M) in the verification (when the signature information (δ _ID , M) is correct), the verification device 23 transmits to the terminal device 22 that the signature information (δ ID, M) has been received, and when the result is not accepted. Transmits to the terminal device 22 that it is not accepted. The verification device 23 is provided in a server or the like provided by the service provider.

[Modification 1]
The signature processing (registration) in the first modification will be described.
FIG. 4 is a diagram showing an example of a cryptographic signature processing system (modification example 1). The setting device 21 first acquires the security parameter k. Subsequently, the setting device 21 generates the parameter Param using the security parameter k. The parameter Param is obtained, for example, by executing Setup (1 ^ k). Specifically, the parameter Param is generated using an elliptic curve, a group G having a k-bit prime order p on the elliptic curve, a generator g of the group G, and the like. 1 ^ k is data in which 1s are arranged by k bits. In addition, other notation which means that the security parameter is k may be used.

Subsequently, the setting device 21 generates the master secret key msk using the hash function H. For example, the master private key msk is obtained by executing KeyGen_msk (param, 1 ^ k). The master secret key msk is, for example, a value randomly selected from [1, p-1]. p is a prime number defined by param.

Further, the setting device 21 generates the master public key mpk. For example, the master public key mpk is mpk = (Param, H). H is a cryptographically secure hash function that takes an arbitrary binary sequence {0,1} * as an input and outputs a value of [1, p-1].

Subsequently, the setting device 21 installs the public key generation program in which the master public key mpk = (Param, H) is embedded in the public key information generation unit 24, and installs the private key generation program in which the master private key msk is embedded in the private key. Install in the information generation unit 2.

The public key information generation unit 24 applies the hash function H to the master private key msk and the application ID to generate the private key sk (= H (msk, ID)). Further, the public key information generation unit 24 generates the public key pk by using the parameter Param, the data 1 ^ k, and the private key sk. For example, the public key pk is obtained by executing KeyGen_pk (Param, 1 ^ k, sk), and pk = [sk] g. Here, [x] g means a constant x times the point g on the elliptic curve.

Further, the public key information generation unit 24 uses the secret unit 4 to conceal the calculation results generated in the process of generating the master private key msk, the private key sk, the public key pk, the private key sk, and the public key pk. While generating the private key sk and the public key pk.

Subsequently, when registering to use the service, the terminal device 22 transmits the public key pk generated by the public key information generation unit 24 to the verification device 23. ,

The signature processing (authentication) in the first modification will be described.
The secret key information generation unit 2 applies the hash function H to the master secret key msk and the application ID to generate the secret key sk (= H (msk, ID)). The signature information generation unit 3 generates signature information (δ _ID , M) using the private key sk and the message M. The signature information (δ _ID , M) is obtained by executing, for example, Sigma (pk, sk, M). Subsequently, the signature information generation unit 3 _{transmits the signature information (δ ID} , M) to the verification device 23. For example, SigGen (pk, sk, M) is a signature generation of EC-DSA and EC-Schnorr signatures. Here, the digital signature method using an elliptic curve is taken as an example, but other signature methods may be used.

_{The signature information generation unit 3 may generate signature information (δ ID} , M) by using the private key sk, the message M, and the public key pk. In this case, apart from the public key information generation unit 24, the private key information generation unit 2 or the signature information generation unit 3 generates the public key pk using the parameters Param, data 1 ^ k, and private key sk.

The verification device 23 verifies using the registered public key pk and the received signature information (δ _ID , M). For verification, for example, Verify (pk, (δ _ID , M)) is executed to verify whether the acceptance or rejection is accepted. Further, after the verification, the verification device 23 transmits to the terminal device 22 that it has been accepted if it has been accepted, and transmits to the terminal device 22 that it has not been accepted if it has not been accepted. For example, Verify (pk, (δ _ID , M)) is a signature verification of EC-DSA and EC-Schnorr signatures. Here, the digital signature method using an elliptic curve is taken as an example, but other signature methods may be used.

[Modification 2]
FIG. 5 is a diagram showing an example of a cryptographic signature processing system (modification example 2). In the second modification, a case where the ID-based signature method is used will be described. The ID-based signature method consists of four algorithms: ID-Setup, ID-KeyGen, ID-SigmaGen, and ID-Verify.

ID-Setup takes the security parameter k as an input and generates the master private key msk and the master public key mpk. ID-KeyGen takes the master secret key msk and ID as input, and generates the _{secret key sk ID corresponding to the ID.} ID-Sigma Gen _{generates signature information (σ ID} , M) by _{inputting the private key sk ID} corresponding to the ID and the signature target message M. ID-Verify takes the master public key mpk and signature information (σ _ID , M) as input, and generates acceptance or rejection. As the ID-based signature method, many methods are known, for example, the methods described in Patent Document 1 and Patent Document 2.

The signature process (registration) in the second modification will be described.
The setting device 21 first acquires the security parameter k. Subsequently, the setting device 21 executes ID-Setup (1 ^ k) using the security parameter k to generate the master private key msk and the master public key mpk.

For example, the master secret key msk = s is a value randomly selected from [1, q-1]. Note that q is a prime number. The master public key mpk = (G1, G2, e, P, Ppub, H1, H2) is generated by utilizing the property of the bilinear map e. The bilinear map e maps from G1 × G1 to G2 with respect to the groups G1 and G2 on two elliptic curves whose order is prime q. The generator P is a value belonging to the group G1. Ppub is calculated by [s] P. H1 is a hash function that maps an arbitrary binary series {0,1} * to the group G1 on the elliptic curve. H2 is a hash function that maps {0,1} * × G1 to [1, q-1].

Subsequently, the setting device 21 installs a private key generation program in which the master private key msk and the master public key mpk are embedded in the private key information generation unit 2. The setting device 21 may store the master public key mpk in any memory of the terminal device 22 separately from the private key generation program.

Further, in the second modification, the signature processing device 1 of the terminal device 22 does not have to be provided with the public key information generation unit 24. The reason is that the master public key mpk is used as the public key pk. Further, by doing so, there is no risk of leaking the master private key msk, the private key sk, and the calculation results related to them when the public key pk is generated.

Subsequently, when registering to use the service, the terminal device 22 transmits the master public key mpk to the verification device 23.

The signature processing (authentication) in the second modification will be described.
The private key information generation unit 2 executes ID-KeyGen (msk, ID) using the master secret key msk and the application _ID to generate the private key sk ID. The private key sk _ID is obtained by executing, for example, [s] Q _ID (= H1 (ID)).

The signature information generation unit 3 executes ID-Sigma (sk _{ID , M) using the private key sk ID} and the message M to generate signature information (δ _ID , M). The signature information (δ _ID , M) is, for example, δ _ID = (U, V). U is calculated by _{[r] Q ID.} r is a value randomly selected from [1, q-1]. V is calculated by [r + h] sk _ID. h is calculated by H2 (M, U).

Subsequently, the signature information generation unit 3 _{transmits the signature information (δ ID} , M) to the verification device 23.

The signature information generation unit 3 may generate _{signature information (δ ID} , M) by _{using the private key sk ID} , the message M, and the master public key mpk.

The verification device 23 verifies using the registered public key pk (= master public key mpk), the application ID, and the received signature information (δ _ID , M). For verification, for example, ID-Verify (mpk, ID, (δ _ID , M)) is executed, and if e (Ppub, U + [h], Q _ID ) = e (P, V) is established, the verification is accepted, otherwise. In the case, the rejection is output. However, h = H2 (M, U). Further, after the verification, the verification device 23 transmits to the terminal device 22 that it has been accepted if it has been accepted, and transmits to the terminal device 22 that it has not been accepted if it has not been accepted.

[Device operation]
Next, the operation of the signature processing apparatus according to the embodiment of the present invention will be described with reference to FIGS. 2 to 5. FIG. 6 is a diagram showing an example of the operation of the signature processing system (registration). FIG. 7 is a diagram showing an example of the operation of the signature processing system (authentication). In the following description, FIGS. 2 to 5 will be referred to as appropriate. Further, in the present embodiment, the signature processing method is implemented by operating the signature processing device 1. Therefore, the description of the signature processing method in the present embodiment will be replaced with the following description of the operation of the signature processing device 1.

First, the operation of registration of the signature processing system 20 will be described with reference to FIG.
First, the setting device 21 acquires the security parameter k and generates the master secret key msk based on the security parameter k (step A1). Subsequently, the setting device 21 sets the generated master secret key msk in the terminal device 22 (step A2).

Specifically, the setting device 21 first acquires the security parameter k prepared by the manufacturer, and generates the master public key mpk and the master private key msk corresponding to the security parameter k based on the security parameter k.

Subsequently, the setting device 21 stores the generated master public key mpk and master private key msk in the signature processing device 1 of the terminal device 22. For example, the setting device 21 generates a public key generation program and a private key generation program in which the master private key msk is embedded, installs the public key generation program in the public key information generation unit 24, and installs the private key generation program in the private key. Install in the information generation unit 2.

Subsequently, the public key information generation unit 24 of the terminal device 22 is based on the preset master private key msk, the application ID corresponding to the service, and the master public key mpk, and the public key pk corresponding to the application ID. Is generated (step A3).

The secret unit 4 of the terminal device 22 temporarily stores the master secret key msk, the public key pk, or both of them, which are generated in the process of generating the public key pk, in the secret area. Further, the secret unit 4 may temporarily store the calculation result related to the master secret key msk, which is generated in the process of generating the public key pk, in the secret area.

Subsequently, the terminal device 22 transmits the public key pk to the verification device 23 provided in the service provider server or the like (step A4). When the verification device 23 of the service provider server receives the public key pk, it stores the public key pk (step A5). Specifically, when the verification device 23 receives the public key pk, the verification device 23 stores the user information and the public key pk in association with each other. After that, the verification device 23 generates a user ID that identifies the user and transmits it to the terminal device 22. For example, when applied to FIDO (Fast IDentity Online), the public parameter is signed with the Authenticator's Attestation private key.

[Modification 1]
The signature processing (registration) in the first modification will be described with reference to FIG.
In step A1, the setting device 21 executes Setup (1 ^ k) using the security parameter k to generate the parameter Param. Subsequently, the setting device 21 executes KeyGen_msk (param, 1 ^ k) using the parameter Param to generate the master secret key msk. The setting device 21 generates the master public key mpk = (Param, H).

In step A2, the setting device 21 installs the public key generation program in which the master public key is embedded in the public key information generation unit 24, and installs the private key generation program in which the master private key msk is embedded in the private key information generation unit 2. To do.

In step A3, the public key information generation unit 24 applies the hash function H to the master private key msk and the application ID to generate the private key sk (= H (msk, ID)). Subsequently, the public key information generation unit 24 executes KeyGen_pk (Param, 1 ^ k, sk) using the parameters Param, data 1 ^ k, and private key sk to generate the public key pk. In step A3, the public key information generation unit 24 uses the secret unit 4 to display the calculation results generated in the process of generating the master private key msk, the private key sk, the public key pk, the private key sk, and the public key pk. The private key sk and the public key pk are generated while keeping them secret.

In step A4, the terminal device 22 transmits the public key pk generated by the public key information generation unit 24 to the verification device 23.

[Modification 2]
The signature processing (registration) in the second modification will be described with reference to FIG.
In step A1, the setting device 21 executes ID-Setup (1 ^ k) using the security parameter k to generate the master private key msk and the master public key mpk.

In step A2, the setting device 21 installs the secret key generation program in which the master secret key msk is embedded in the secret key information generation unit 2.

In the second modification, the process of step A3 does not have to be executed. The reason is that the master public key mpk is used as the public key pk. By doing so, when the public key pk is generated, the risk of leaking the master private key msk, the private key sk, and the calculation results related to them is reduced.

In step A4, the terminal device 22 transmits the master public key mpk to the verification device 23.

Next, the operation of authentication of the signature processing system 20 will be described with reference to FIG. 7.
_{The private key information generation unit 2 first generates a private key sk ID} corresponding to the application ID based on the master secret key msk and the application ID (step B1).

Subsequently, the signature information generation unit 3 generates _{signature information (δ ID , M) corresponding to the message M based on the private key sk ID} and the message M to be signed for authentication (step B2). Specifically, the terminal device 22 transmits a user ID to the service provider server, and the service provider server receives a message M (for example, a random value (challenge)) corresponding to the service. After that, the signature information generation unit 3 generates signature information (δ _ID , M).

Subsequently, the terminal device 22 transmits the generated public key pk and signature information (δ _ID , M) to the verification device 23 (step B3).

Here, the secret key information generation unit 2 and the signature information generation unit 3 are the master secret key in the secret area of the secret unit 4, which is generated in the process of generating _{the secret key sk ID} or the signature information (δ _{ID, M).} The msk, the private key sk _ID , or both are temporarily stored in the generation process. Further, the secret unit 4 is a calculation result related to the master secret key msk or a calculation result related to the secret key sk _ID , _{which is generated in the process of generating the secret key sk ID} or the signature information (δ _{ID, M).} , Or the calculation results related to both of them are temporarily stored in the generation process.

_{In the process of generating the secret key sk ID} or the signature information (δ _ID , M), the secret unit 4 determines that the master secret key msk, the secret key sk _ID , and the calculation result will not be used for the subsequent generation. After that, the master secret key msk, the secret key sk _ID , and the calculation result temporarily stored within the predetermined time are deleted from the secret area.

_{Subsequently, the verification device 23 verifies the signature information (δ ID} , M) generated based on the message M by using the public key pk registered when using the service (step B4). Further, the verification device 23 transmits to the terminal device 22 that it has been accepted if it has been accepted after the verification, and transmits to the terminal device 22 that it has not been accepted if it has not been accepted (step B5).

[Modification 1]
The signature processing (authentication) in the first modification will be described with reference to FIG. 7.
In step B1, the secret key information generation unit 2 applies the hash function H to the master secret key msk and the application ID to generate the secret key sk (= H (msk, ID)).

In step B2, the signature information generation unit 3 executes SigGen (pk, sk, M) using the private key sk and the message M _{to generate signature information (δ ID} , M).

In step B3, the signature information generation unit 3 _{transmits the signature information (δ ID} , M) to the verification device 23.

_{The signature information generation unit 3 may generate signature information (δ ID} , M) by using the private key sk, the message M, and the public key pk. In this case, the public key pk is the public key pk by the private key information generation unit 2 or the signature information generation unit 3 using the parameters Param, data 1 ^ k, and private key sk, separately from the public key information generation unit 24. To generate.

In step B4, the verification device 23 executes Verify (pk, (δ _ID , M)) using the registered public key pk and the received signature information (δ _{ID, M), and accepts the result.} Verify that it is not accepted.

In step B5, after the verification, the verification device 23 transmits to the terminal device 22 that it has been accepted if it has been accepted, and transmits to the terminal device 22 that it has not been accepted if it has not been accepted.

[Modification 2]
The signature processing (authentication) in the second modification will be described with reference to FIG. 7.
In step B1, the secret key information generation unit 2 executes ID-KeyGen (msk, ID) using the master secret key msk and the application ID to generate the secret key sk.

In step B2, the signature information generation unit 3 executes ID-Sigma (sk _ID , M) using the private key sk and the message M, and generates signature information (δ _ID , M). In step B2, the signature information generation unit 3 may generate _{signature information (δ ID} , M) by _{using the private key sk ID} , the message M, and the master public key mpk.

In step B3, the signature information generation unit 3 _{transmits the signature information (δ ID} , M) to the verification device 23.

In step B4, the verification device 23 executes ID-Verify (mpk, ID, (δ _ID , M)) using the registered public key pk and the received signature information (δ _{ID, M).} And verify whether it is accepted or not accepted.

In step B5, after the verification, the verification device 23 transmits to the terminal device 22 that it has been accepted if it has been accepted, and transmits to the terminal device 22 that it has not been accepted if it has not been accepted.

[Effect of this embodiment]
As described above, according to the present embodiment, even when the private key sk is generated during the execution of the application, the private key can be protected as in the white box implementation method. That is, even when the secret key is dynamically generated based on the master secret key msk stored in advance in the signature processing device 1 and the application ID that identifies the application, the secret unit 4 is used to generate the secret key. Therefore, it is possible to prevent the private key from being leaked to the outside.

Further, in the present embodiment, based on the message M is signed with a private key, the signature information ([delta] _ID, M) even when generating the signature information ([delta] _ID uses the encryption unit 4, M ) Is generated, so that the private key cannot be leaked to the outside.

Further, since the master private key msk, the public key pk, or both of them, which are generated in the process of generating the public key pk, are temporarily stored in the secret area, the information can be prevented from being leaked to the outside. .. Further, since the calculation result related to the master private key msk generated in the process of generating the public key PK is temporarily stored in the secret area, it is possible to prevent the information from being leaked to the outside.

Further, according to the present embodiment, since the signature processing device 1 dynamically generates the private key while keeping it secret for each application, it is possible to prevent the manufacturer from grasping the private key. Further, since a plurality of private keys are not stored in the signature processing device 1 in advance, the storage capacity of the signature processing device 1 can be reduced.

Further, according to the present embodiment, since the signature processing device 1 can dynamically generate the private key while keeping it secret, it is possible to protect the private key from being leaked to the outside even if the private key is changed. it can.

[program]
The program according to the embodiment of the present invention may be a program that causes a computer to execute steps A1 to A5 shown in FIG. 6 and steps B1 to B5 shown in FIG. By installing this program on a computer and executing it, the signature processing device and the signature processing method according to the present embodiment can be realized. In this case, the computer processor functions as a private key information generation unit 2, a signature information generation unit 3, a secret unit 4, and a public key information generation unit 24, and performs processing.

Further, the program in the present embodiment may be executed by a computer system constructed by a plurality of computers. In this case, for example, each computer may function as one of the private key information generation unit 2, the signature information generation unit 3, the secret unit 4, and the public key information generation unit 24, respectively.

[Physical configuration]
Here, a computer that realizes the signature processing device 1 by executing the program according to the embodiment will be described with reference to FIG. FIG. 8 is a diagram showing an example of a computer that realizes a signature processing device.

As shown in FIG. 8, the computer 110 includes a CPU 111, a main memory 112, a storage device 113, an input interface 114, a display controller 115, a data reader / writer 116, and a communication interface 117. Each of these parts is connected to each other via a bus 121 so as to be capable of data communication. The computer 110 may include a GPU (Graphics Processing Unit) or an FPGA (Field-Programmable Gate Array) in addition to the CPU 111 or in place of the CPU 111.

The CPU 111 expands the programs (codes) of the present embodiment stored in the storage device 113 into the main memory 112 and executes them in a predetermined order to perform various operations. The main memory 112 is typically a volatile storage device such as a DRAM (Dynamic Random Access Memory). Further, the program according to the present embodiment is provided in a state of being stored in a computer-readable recording medium 120. The program in the present embodiment may be distributed on the Internet connected via the communication interface 117.

Further, specific examples of the storage device 113 include a semiconductor storage device such as a flash memory in addition to a hard disk drive. The input interface 114 mediates data transmission between the CPU 111 and an input device 118 such as a keyboard and mouse. The display controller 115 is connected to the display device 119 and controls the display on the display device 119.

The data reader / writer 116 mediates the data transmission between the CPU 111 and the recording medium 120, reads the program from the recording medium 120, and writes the processing result in the computer 110 to the recording medium 120. The communication interface 117 mediates data transmission between the CPU 111 and another computer.

Specific examples of the recording medium 120 include a general-purpose semiconductor storage device such as CF (Compact Flash (registered trademark)) and SD (Secure Digital), a magnetic recording medium such as a flexible disk, or a CD-. Examples include optical recording media such as ROM (Compact Disk Read Only Memory).

The signature processing device 1 in the present embodiment can also be realized by using hardware corresponding to each part instead of the computer in which the program is installed. Further, the signature processing device 1 may be partially realized by a program and the rest may be realized by hardware.

[Additional Notes]
The following additional notes will be further disclosed with respect to the above embodiments. A part or all of the above-described embodiments can be expressed by the following descriptions (Appendix 1) to (Appendix 20), but the present invention is not limited to the following description.

(Appendix 1)
A private key information generation unit that generates private key information corresponding to the application identification information based on preset master private key information and application identification information that identifies an application.
A signature information generation unit that generates signature information corresponding to the message information based on the private key information and the message information to be signed.
In the process of generating the secret key information or the signature information, a secret unit having a secret area for temporarily storing the master secret key information, the secret key information, or both of them.
Signature processing device with.

(Appendix 2)
The signature processing device according to Appendix 1.
In the process of generating the secret key information or the signature information, the secret unit performs an operation result related to the master secret key information, an operation result related to the secret key information, or an operation related to both of them. A signature processing device characterized by temporarily storing the results.

(Appendix 3)
The signature processing device described in Appendix 2, which is the signature processing device.
When the secret unit determines in the process of generating the secret key information or the signature information that the master secret key information, the secret key information, and the calculation result will not be used for generation thereafter, within a predetermined time after the determination. A signature processing device for erasing the master secret key information, the secret key information, and the calculation result temporarily stored in the secret area.

(Appendix 4)
The signature processing device according to any one of Appendix 1 to 3.
The secret key information generation unit is a signature processing device that generates the secret key information by using a hash function for the master secret key information and the application identification information.

(Appendix 5)
The signature processing device according to any one of Appendix 1 to 4.
A public key information generation unit that generates public key information corresponding to the application identification information based on the master private key information, the application identification information, and the master public key information.
The secret unit is a signature processing device that temporarily stores the master private key information, the public key information, or both in the process of generating the public key information.

(Appendix 6)
(A) A step of generating the private key information corresponding to the application identification information based on the preset master private key information and the application identification information for identifying the application.
(B) A step of generating signature information corresponding to the message information based on the private key information and the message information to be signed.
(C) In the process of generating the secret key information or the signature information, a step of temporarily storing the master secret key information, the secret key information, or both in a secret area, and
Signature processing method with.

(Appendix 7)
The signature processing method described in Appendix 6
In the step (c), in the process of generating the secret key information or the signature information, the calculation result related to the master secret key information, the calculation result related to the secret key information, or both of them. A signature processing method characterized by temporarily storing the related calculation results.

(Appendix 8)
The signature processing method described in Appendix 7.
In the step (c), in the process of generating the secret key information or the signature information, if it is determined that the master secret key information, the secret key information, and the calculation result will not be used for generation thereafter, after the determination. A signature processing method comprising erasing the master secret key information, the secret key information, and the calculation result temporarily stored within a predetermined time from the secret area.

(Appendix 9)
The signature processing method according to any one of Appendix 6 to 8.
The signature processing method, characterized in that, in the step (b), the secret key information is generated by using a hash function for the master secret key information and the application identification information.

(Appendix 10)
The signature processing method according to any one of Appendix 6 to 9.
(D) It has a step of generating public key information corresponding to the application identification information based on the master private key information, the application identification information, and the master public key information.
A signature processing method comprising temporarily storing the master private key information, the public key information, or both in the process of generating the public key information in the step (c).

(Appendix 11)
A setting device that sets the master private key information generated based on security information in the signature processing device in a secret state, and
Based on the preset master private key information and the application identification information that identifies the application, the private key information corresponding to the application identification information is generated, and based on the private key information and the message information to be signed. , The master secret key information, the secret key information, or both are temporarily stored in the secret area in the process of generating the signature information corresponding to the message information and generating the secret key information or the signature information. With the terminal device
A signature processing system including a verification device that verifies the signature information based on the message information.

(Appendix 12)
The signature processing system according to Appendix 11,
In the process of generating the secret key information or the signature information, the terminal device performs an operation result related to the master secret key information, an operation result related to the secret key information, or an operation related to both of them. A signature processing system characterized by temporarily storing the results.

(Appendix 13)
The signature processing system described in Appendix 12
When the terminal device determines in the process of generating the secret key information or the signature information that the master secret key information, the secret key information, and the calculation result will not be used for generation thereafter, within a predetermined time after the determination. A signature processing system comprising erasing the master secret key information, the secret key information, and the calculation result from the secret area.

(Appendix 14)
The signature processing system according to any one of Appendix 11 to 13.
The terminal device is a signature processing system characterized in that the secret key information is generated by using a hash function for the master secret key information and the application identification information.

(Appendix 15)
The signature processing system according to any one of Appendix 11 to 14.
In the process of generating the public key information corresponding to the application identification information based on the master private key information, the application identification information, and the master public key information, the terminal device generates the public key information. , The master private key information, the public key information, or both of them are temporarily stored.

(Appendix 16)
On the computer
(A) A step of generating the private key information corresponding to the application identification information based on the preset master private key information and the application identification information for identifying the application.
(B) A step of generating signature information corresponding to the message information based on the private key information and the message information to be signed.
(C) In the process of generating the secret key information or the signature information, a step of temporarily storing the master secret key information, the secret key information, or both in a secret area, and
A computer-readable recording medium that records a program that runs a program.

(Appendix 17)
A computer-readable recording medium on which the program described in Appendix 16 is recorded.
In the step (c), in the process of generating the secret key information or the signature information, the calculation result related to the master secret key information, the calculation result related to the secret key information, or both of them. A computer-readable recording medium that records a program characterized by temporarily storing the results of related operations.

(Appendix 18)
A computer-readable recording medium on which the program described in Appendix 17 is recorded.
In the step (c), in the process of generating the secret key information or the signature information, if it is determined that the master secret key information, the secret key information, and the calculation result will not be used for generation thereafter, after the determination. A computer-readable recording medium on which a program recording a program characterized by erasing the master secret key information, the secret key information, and the calculation result temporarily stored within a predetermined time from the secret area.

(Appendix 19)
A computer-readable recording medium on which the program according to Appendix 16 or 18 is recorded.
A computer-readable recording medium on which a program is recorded, which comprises generating the secret key information by using a hash function for the master secret key information and the application identification information in the step (b).

(Appendix 20)
A computer-readable recording medium on which the program described in any one of Appendix 16 to 19 is recorded.
On the computer
(D) The step of generating the public key information corresponding to the application identification information based on the master private key information, the application identification information, and the master public key information is executed.
In the step (c), in the process of generating the public key information, a computer reading that records a program characterized by temporarily storing the master private key information, the public key information, or both of them. Possible recording medium.

Although the present invention has been described above with reference to the embodiments, the present invention is not limited to the above embodiments. Various changes that can be understood by those skilled in the art can be made within the scope of the present invention in terms of the structure and details of the present invention.

As described above, according to the present invention, the private key can be protected even when the private key is dynamically generated. The present invention is useful in fields where it is necessary to dynamically generate a private key.

1 Signature processing device 2 Private key information generation unit 3 Signature information generation unit 4 Secret unit 20 Signature processing system 21 Setting device 22 Terminal device 23 Verification device 24 Public key information generation unit 110 Computer 111 CPU
112 Main memory 113 Storage device 114 Input interface 115 Display controller 116 Data reader / writer 117 Communication interface 118 Input device 119 Display device 120 Recording medium 121 Bus

The present invention, the signature processing apparatus, the signature processing method for the signature process relates signature processing system, further relates to a program for realizing these.

An example of an object of the present invention is to provide a signature processing device, a signature processing method, a signature processing system, and a program capable of protecting a private key even when dynamically generating private key information.

Furthermore, in order to achieve the above object, the program according to an aspect of the present invention,
On the computer
(A) A step of generating the private key information corresponding to the application identification information based on the preset master private key information and the application identification information for identifying the application.
(B) A step of generating signature information corresponding to the message information based on the private key information and the message information to be signed.
(C) In the process of generating the secret key information or the signature information, a step of temporarily storing the master secret key information, the secret key information, or both in a secret area, and
Is characterized by executing.

(Appendix 16)
On the computer
(A) A step of generating the private key information corresponding to the application identification information based on the preset master private key information and the application identification information for identifying the application.
(B) A step of generating signature information corresponding to the message information based on the private key information and the message information to be signed.
(C) In the process of generating the secret key information or the signature information, a step of temporarily storing the master secret key information, the secret key information, or both in a secret area, and
Program to be run.

(Appendix 17)
A program according to appendix 16,
In the step (c), in the process of generating the secret key information or the signature information, the calculation result related to the master secret key information, the calculation result related to the secret key information, or both of them. program, characterized in that temporarily stores calculation results related.

(Appendix 18)
A program according to appendix 17,
In the step (c), in the process of generating the secret key information or the signature information, if it is determined that the master secret key information, the secret key information, and the calculation result will not be used for generation thereafter, after the determination. temporarily stored within a predetermined time, the master secret key information, the secret key information, the calculation result, programs, characterized by erasing from the secret area.

(Appendix 19)
A program according to any one of Supplementary Note 16 18,
In said step of (b), program, characterized in that by using a hash function as the master secret key information and the application identification information to generate the secret key information.

(Appendix 20)
A program according to any one of Supplementary Note 16 19,
On the computer
(D) The step of generating the public key information corresponding to the application identification information based on the master private key information, the application identification information, and the master public key information is executed.
In said step of (c), in the process of generating the public key information, the master secret key information, or, the public key information or programs, characterized by storing them both time.

Claims (20)

A private key information generation means that generates private key information corresponding to the application identification information based on preset master private key information and application identification information that identifies an application.
A signature information generation means that generates signature information corresponding to the message information based on the private key information and the message information to be signed.
In the process of generating the secret key information or the signature information, a secret means having a secret area for temporarily storing the master secret key information, the secret key information, or both of them.
Signature processing device with. The signature processing device according to claim 1.
In the process of generating the secret key information or the signature information, the concealment means is an operation result related to the master secret key information, an operation result related to the secret key information, or an operation related to both of them. A signature processing device characterized by temporarily storing the results. The signature processing device according to claim 2.
When it is determined that the master secret key information, the secret key information, and the calculation result will not be used for the subsequent generation in the process of generating the secret key information or the signature information, the concealment means is within a predetermined time after the determination. A signature processing device for erasing the master secret key information, the secret key information, and the calculation result temporarily stored in the secret area. The signature processing device according to any one of claims 1 to 3.
The secret key information generation means is a signature processing device characterized in that the secret key information is generated by using a hash function for the master secret key information and the application identification information. The signature processing device according to any one of claims 1 to 4.
A public key information generation means that generates public key information corresponding to the application identification information based on the master private key information, the application identification information, and the master public key information.
The secret means is a signature processing device that temporarily stores the master private key information, the public key information, or both in the process of generating the public key information. (A) A step of generating the private key information corresponding to the application identification information based on the preset master private key information and the application identification information for identifying the application.
(B) A step of generating signature information corresponding to the message information based on the private key information and the message information to be signed.
(C) In the process of generating the secret key information or the signature information, a step of temporarily storing the master secret key information, the secret key information, or both in a secret area, and
Signature processing method with. The signature processing method according to claim 6.
In the step (c), in the process of generating the secret key information or the signature information, the calculation result related to the master secret key information, the calculation result related to the secret key information, or both of them. A signature processing method characterized by temporarily storing the related calculation results. The signature processing method according to claim 7.
In the step (c), in the process of generating the secret key information or the signature information, if it is determined that the master secret key information, the secret key information, and the calculation result will not be used for generation thereafter, after the determination. A signature processing method comprising erasing the master secret key information, the secret key information, and the calculation result temporarily stored within a predetermined time from the secret area. The signature processing method according to any one of claims 6 to 8.
The signature processing method, characterized in that, in the step (b), the secret key information is generated by using a hash function for the master secret key information and the application identification information. The signature processing method according to any one of claims 6 to 9.
(D) It has a step of generating public key information corresponding to the application identification information based on the master private key information, the application identification information, and the master public key information.
A signature processing method comprising temporarily storing the master private key information, the public key information, or both in the process of generating the public key information in the step (c). A setting device that sets the master private key information generated based on security information in the signature processing device in a secret state, and
Based on the preset master private key information and the application identification information that identifies the application, the private key information corresponding to the application identification information is generated, and based on the private key information and the message information to be signed. , The master secret key information, the secret key information, or both are temporarily stored in the secret area in the process of generating the signature information corresponding to the message information and generating the secret key information or the signature information. With the terminal device
A signature processing system including a verification device that verifies the signature information based on the message information. The signature processing system according to claim 11.
In the process of generating the secret key information or the signature information, the terminal device performs an operation result related to the master secret key information, an operation result related to the secret key information, or an operation related to both of them. A signature processing system characterized by temporarily storing the results. The signature processing system according to claim 12.
When the terminal device determines in the process of generating the secret key information or the signature information that the master secret key information, the secret key information, and the calculation result will not be used for generation thereafter, within a predetermined time after the determination. A signature processing system comprising erasing the master secret key information, the secret key information, and the calculation result from the secret area. The signature processing system according to any one of claims 11 to 13.
The terminal device is a signature processing system characterized in that the secret key information is generated by using a hash function for the master secret key information and the application identification information. The signature processing system according to any one of claims 11 to 14.
In the process of generating the public key information corresponding to the application identification information based on the master private key information, the application identification information, and the master public key information, the terminal device generates the public key information. , The master private key information, the public key information, or both of them are temporarily stored. On the computer
(A) A step of generating the private key information corresponding to the application identification information based on the preset master private key information and the application identification information for identifying the application.
(B) A step of generating signature information corresponding to the message information based on the private key information and the message information to be signed.
(C) In the process of generating the secret key information or the signature information, a step of temporarily storing the master secret key information, the secret key information, or both in a secret area, and
A computer-readable recording medium that records a program that runs a program. A computer-readable recording medium on which the program according to claim 16 is recorded.
In the step (c), in the process of generating the secret key information or the signature information, the calculation result related to the master secret key information, the calculation result related to the secret key information, or both of them. A computer-readable recording medium that records a program characterized by temporarily storing the results of related operations. A computer-readable recording medium on which the program according to claim 17 is recorded.
In the step (c), in the process of generating the secret key information or the signature information, if it is determined that the master secret key information, the secret key information, and the calculation result will not be used for generation thereafter, after the determination. A computer-readable recording medium on which a program recording a program characterized by erasing the master secret key information, the secret key information, and the calculation result temporarily stored within a predetermined time from the secret area. A computer-readable recording medium on which the program according to claim 16 or 18 is recorded.
A computer-readable recording medium on which a program is recorded, which comprises generating the secret key information by using a hash function for the master secret key information and the application identification information in the step (b). A computer-readable recording medium on which the program according to any one of claims 16 to 19 is recorded.
On the computer
(D) The step of generating the public key information corresponding to the application identification information based on the master private key information, the application identification information, and the master public key information is executed.
In the step (c), in the process of generating the public key information, a computer reading that records a program characterized by temporarily storing the master private key information, the public key information, or both of them. Possible recording medium.

Images